Nautobot and CVE-2021-23727 (Celery OS command injection attack)

[jathanism]

Nautobot versions 1.1.0 through 1.2.2 are vulnerable to CVE-2021-23727 which affects Celery versions before 5.2.2. Nautobot v1.2.3 requires Celery version 5.2.2 or later, which requires Python 3.7 or later.

It is highly recommended that users of Python 3.6 prioritize upgrading to a newer version of Python. Nautobot will be removing support for Python 3.6 in a future update.

For users remaining on Python 3.6, please know that upgrading to Nautobot v1.2.3 will not resolve this CVE for your installation. The only remedy at this time is to upgrade your systems utilize Python 3.7 or later.